Harmony’s ONE token plunged roughly 37% after an attacker exploited the Layer-1 blockchain to mint approximately 4 billion unauthorized ONE tokens — an amount equivalent to about 26% of the previously reported supply.

The exploit has left Harmony facing an extraordinary choice: roll back the blockchain to erase the attacker’s tokens, or preserve the chain and risk leaving billions of newly created tokens in circulation.

Billions of ONE tokens created out of thin air

On-chain analyst Juiceberg first flagged the unauthorized mint early on Aug. 12, estimating that nearly 4 billion ONE had been created through what appeared to be “empty blocks.” Around 2.8 billion of the newly minted tokens had already been funneled to cryptocurrency exchanges as the token price collapsed.

In a subsequent update, Juiceberg said the attacker had roughly 115 million ONE remaining on-chain, representing about 2.9% of the newly minted amount. The remaining 97% was already sitting on exchanges, either sold or held in deposit wallets.

Harmony subsequently confirmed that the blockchain had been exploited and said it was “working with our team and appropriate exchanges to stop and freeze the funds.” The project also identified four wallets associated with the attack and asked exchanges to block transactions linked to them.

The scale of the mint created an immediate supply shock, although the full impact was difficult to measure. Harmony’s totalSupply endpoint did not initially reflect the newly created tokens, while several price trackers continued to show circulating supply at roughly 14.87 billion ONE.

Harmony patches the network but faces a painful rollback choice

Harmony moved to contain the exploit, pausing its bridge roughly two hours after its initial disclosure before releasing an emergency validator patch. Validators were instructed to upgrade to a new build designed to prevent further unauthorized minting.

Stopping the exploit, however, did not solve the problem of what to do with the billions of tokens already created. Harmony said it was weighing rollback options, potentially returning the blockchain to a point before the exploit occurred. Such a move would effectively remove the attacker’s transactions from the accepted chain history.

But a rollback would come with a significant cost: every legitimate transaction made after the attack would also disappear.

That creates an unusually difficult choice for Harmony. Protecting the integrity of the ONE supply could mean sacrificing legitimate activity from users who had nothing to do with the exploit. Preserving the existing chain, meanwhile, could leave billions of unauthorized tokens — many of which have already reached exchanges — hanging over the network.

The dilemma is particularly significant given Harmony’s history of security failures. In June 2022, hackers drained approximately $100 million from Harmony’s Horizon cross-chain bridge. The FBI later attributed the attack to North Korea’s Lazarus Group.

Harmony initially proposed compensating victims of that attack by minting billions of new ONE tokens and hard-forking the network. The proposal triggered significant community criticism before the project abandoned it in favor of compensation funded through its treasury.

Four years later, Harmony is once again confronting a scenario involving billions of unauthorized ONE tokens — only this time, the tokens were created by an attacker rather than through a proposed compensation plan.

ONE crashes as confidence takes another hit

ONE was trading around $0.00077 to $0.00080 following the exploit, down roughly 35% to 40% over 24 hours. Its market capitalization had fallen to roughly $11.5 million to $11.7 million, leaving the token outside the top 1,000 cryptocurrencies.

The collapse adds another chapter to ONE’s long decline. The token remains more than 99% below its October 2021 record high of roughly $0.38.

For Harmony, the immediate challenge is no longer simply stopping an attacker. The project must now determine whether reversing the blockchain is worth the collateral damage to legitimate users.

The decision could determine not only what happens to the 4 billion newly minted ONE tokens, but also how much trust users are willing to place in Harmony after yet another major security crisis.